A series of record-breaking RPS-based distributed denial of service (DDoS) attacks observed over the past month are the result of a new, powerful botnet flexing its muscles to prove its capabilities.
Referred to as Mēris (the Latvian word for plague), the botnet is apparently responsible for the largest recorded application layer DDoS assault to date, which, less than a week ago, peaked at 21.8 million requests per second (RPS).
Active since at least June 2021, the botnet has ensnared tens of thousands of devices that use Ethernet connections. To date, the botnet hasn’t shown its true size, but researchers with Qrator Labs believe it is composed of more than 200,000 bots.
Most of the vulnerable devices, the researchers say, are from Mikrotik, which suggests that a previously unknown vulnerability might have been used to compromise them. Ensnared devices run a broad range of RouterOS versions, the majority being on the firmware previous to the current Stable one. To launch DDoS attacks, Mēris employs the HTTP pipelining (http/1.1) technique.
Since the beginning of August, the botnet has apparently launched at least five attacks, each more devastating than the previous one. The first was a 5.2 million RPS assault on August 7, while the last one was last week’s 21.8 million RPS attack on Russian Internet giant Yandex.
The source IPs in the latest attack showed that devices predominantly had ports 2000 and 5678 open, which suggests that they were made by Mikrotik.
Qrator Labs’ researchers discovered “328 723 active hosts on the Internet replying to the TCP probe on port 5678,” with some being Linksys devices, and say that these might be vulnerable to Mēris takeover, if not already ensnared.
The attack on Yandex set a record for application layer attacks roughly two weeks after Cloudflare revealed that it had mitigated a 17.2 million RPS DDoS assault. According to Qrator Labs, Mēris might have been responsible for that incident as well.
Related: TsuNAME Vulnerability Can Be Exploited for DDoS Attacks on DNS Servers
Related: Akamai Sees Largest DDoS Extortion Attack Known to Date
